Porting ExpressVPN to Windows on Snapdragon with a semi-native build

What’s keeping you from porting your X86 apps to Windows CoPilot+ architecture?

We’re the engineering team behind ExpressVPN. We cut our build time down from months to days to deliver a quality product that our users could trust to keep them safe.

If you’re thinking about supporting devices built around Windows on Snapdragon, here’s how we did it.

Porting a high-quality cybersecurity product to Windows on Snapdragon

ExpressVPN is designed for privacy on the internet. VPNs (virtual private networks) prevent internet service providers, Wi-Fi operators and other outsiders from monitoring user activity when connections are routed through the VPN’s encrypted tunnel. They also mask users’ IP addresses to prevent identification and tracking.

Due to the newness of the system, alongside Microsoft’s history of offering emulation support with similar launches in the past, the software most users were expecting at launch took longer to emerge than usual. Early adopters of PCs powered by Snapdragon had trouble finding top-shelf VPN software that could be used on their devices.

The conventional knowledge among software developers was that porting X86 apps would require a lot of work and result in an underperforming product. Even the less labor-intensive alternative of running in emulation would usually mean a hit to performance and security that could leave users’ vulnerable at worst, or frustrated by speeds at best. For ExpressVPN specifically, going against our commitment to quality was an absolute red-line.

ExpressVPN is a cybersecurity brand built on high-quality products and the trust of our users. We were concerned that an emulation of our flagship app, allowing compatibility with Windows on Snapdragon, wouldn’t be up to our usual standards. Any product that deviated from those standards would put the privacy and security of our user base at risk.

Build native with the driver; go emulated with user-mode code

Our engineers also had to address the dual nature of ExpressVPN, which comprises:

1) a driver that performs encryption and;

2) a services layer for UI and back end.

The way that Windows works, emulation supports user-mode code only and does not support drivers. Any kernel-mode components must be compiled as compatible with Snapdragon processors. We were looking at a significant resource investment to build a product that met our exacting standards.

Microsoft requires drivers to be native; that is, compiled for Windows on Snapdragon. And drivers are an integral part of a VPN because they enable network packet redirection. While the driver would need to be native, we realised the rest of the app could run in emulation without risking user privacy.

Qualcomm invited us to discussions with the Snapdragon and Microsoft teams about Prism, the newly released emulator Microsoft introduced with Windows 11 24H2. Compared to the previous emulation technology in Windows, Prism includes significant optimizations that improve the performance and reduce the CPU usage of apps running under emulation. Plus, Prism is optimized and tuned specifically for Snapdragon processors, with some features that take specific advantage of hardware available only in Snapdragon X Series processors.

Based on those discussions and recommendations, our engineers went forward with a port of ExpressVPN to Windows on Snapdragon. To preserve user privacy and security in the driver, we made our patented Lightway protocol natively compatible with Windows on Snapdragon, a process facilitated by the adaptability we had already built into Lightway. We then used Prism to emulate the remaining services like application UI and back end.

Short development cycle, negligible difference in performance

Initially, we estimated that the port would take about three months from start to finish. But optimizing for Windows on Snapdragon was faster and easier than anticipated. Allocating a single engineer, with the improvements in Prism, we delivered an alpha build in under 72 hours, and completed the entire build – from development through quality assurance to launch – within two weeks. We were able to announce a beta release significantly sooner than usual.

Among the metrics of greatest importance to a VPN provider – including time to download, time to install, time to connect and general stability – our engineers saw only minor differences. The emulated app performed within milliseconds of existing builds for other hardware platforms – a welcome result for a non-native build.

Many of our users connect from locations where they depend heavily on ExpressVPN to securely navigate the internet, and any crashes, glitches or bugs in the ported app would have been unacceptable. Application performance, also verified by quality assurance testers at Qualcomm Technologies, did not diminish with emulation and higher-performing Snapdragon processors.

With the compatible build now in beta, our users have offered strongly positive feedback. We attribute the success of the port to product maturity, technical skill, and relationships. For one thing, we based the port on version 12 of the ExpressVPN app which has been in the market as a respected product for more than two years already.

For another, we wouldn’t have achieved such a great outcome for our customers in so little time had it not been for our close collaboration with Qualcomm Technologies. Finally, we needed Microsoft to certify our driver, which can take a while, so Qualcomm Technologies’ relationships with the Microsoft Windows team were extremely valuable.

Tips for you, and next steps for ExpressVPN

ExpressVPN was the first top shelf VPN to launch our Windows on Snapdragon product, meaning we’ve been a leading voice on that conversation since its inception… an enviable asset when most VPN apps still aren’t ready. We have managed to take a compatible, ported application to market while adhering to our usual, exacting standards—keeping our users safe online with this new hardware.

Having accomplished our goal of a best-of-both-worlds hybrid native/emulated product, we have a few tips for you:

1. Porting to Windows on Snapdragon is not as difficult as most developers fear, especially given the Prism emulator.
2. In both code and dependencies, keep an eye out for differences between native and Snapdragon architectures, especially when compiling drivers.
3. In any port, proper QA is even more important than usual. Test its performance and look for anything unexpected that may creep in.
4. You can port to Windows on Snapdragon without compromising on security.

The beta release is available from the ExpressVPN website and the Microsoft Store, to be followed shortly by the full production launch.

We want our user experience on the app to be even faster, so the next step for us is to make the ExpressVPN application entirely native to Windows on Snapdragon. Come see us at CES 2025 this winter. We think you’ll be pleased.